ultimatepopculturefandomcom-20200216-history
Executable and Linkable Format
, , , , , , , and | mime = | magic= 0x7F 'E' 'L' 'F' | url = | owner= Unix System Laboratories | genre= Binary, executable, object, shared library, core dump | container for= Many executable binary formats }} In computing, the Executable and Linkable Format (ELF, formerly named Extensible Linking Format), is a common standard file format for executable files, object code, shared libraries, and core dumps. First published in the specification for the application binary interface (ABI) of the Unix operating system version named System V Release 4 (SVR4),System V Application Binary Interface Edition 4.1 (1997-03-18) and later in the Tool Interface Standard,Tool Interface Standard (TIS) Executable and Linking Format (ELF) Specification Version 1.2 (May 1995) it was quickly accepted among different vendors of Unix systems. In 1999, it was chosen as the standard binary file format for Unix and Unix-like systems on x86 processors by the 86open project. By design, the ELF format is flexible, extensible, and cross-platform. For instance it supports different endiannesses and address sizes so it does not exclude any particular central processing unit (CPU) or instruction set architecture. This has allowed it to be adopted by many different operating systems on many different hardware platforms. File layout Each ELF file is made up of one ELF header, followed by file data. The data can include: * Program header table, describing zero or more memory segments * Section header table, describing zero or more sections * Data referred to by entries in the program header table or section header table The segments contain information that is needed for run time execution of the file, while sections contain important data for linking and relocation. Any byte in the entire file can be owned by one section at most, and orphan bytes can occur which are unowned by any section. }} File header The ELF header defines whether to use 32- or 64-bit addresses. The header contains three fields that are affected by this setting and offset other fields that follow them. The ELF header is 52 or 64 bytes long for 32-bit and 64-bit binaries respectively. It is often set to 0 regardless of the target platform. |- | colspan="2" | 0x08 || colspan="2" | 1 || e_identEI_ABIVERSION |Further specifies the ABI version. Its interpretation depends on the target ABI. Linux kernel (after at least 2.6) has no definition of it , so it is ignored for statically-linked executables. In that case, offset and size of EI_PAD are 8. glibc 2.12+ in case e_identEI_OSABI 3 treats this field as ABI version of the dynamic linker : it defines a list of dynamic linker's features , treats e_identEI_ABIVERSION as a feature level requested by the shared object (executable or dynamic library) and refuses to load it if an unknown feature is requested, i.e. e_identEI_ABIVERSION is greater than the largest known feature . |- | colspan="2" | 0x09 || colspan="2" | 7 || e_identEI_PAD |currently unused |- | colspan="2" | 0x10 || colspan="2" | 2 || e_type | Identifies object file type. |- | colspan="2" | 0x12 || colspan="2" | 2 || e_machine |Specifies target instruction set architecture. Some examples are: |- | colspan="2" | 0x14 || colspan="2" | 4 || e_version |Set to 1 for the original version of ELF. |- | colspan="2" | 0x18 || 4 || 8 || e_entry |This is the memory address of the entry point from where the process starts executing. This field is either 32 or 64 bits long depending on the format defined earlier. |- | 0x1C || 0x20 || 4 || 8 || e_phoff |Points to the start of the program header table. It usually follows the file header immediately, making the offset 0x34 or 0x40 for 32- and 64-bit ELF executables, respectively. |- | 0x20 || 0x28 || 4 || 8 || e_shoff |Points to the start of the section header table. |- | 0x24 || 0x30 || colspan="2" | 4 || e_flags |Interpretation of this field depends on the target architecture. |- | 0x28 || 0x34 || colspan="2" | 2 || e_ehsize |Contains the size of this header, normally 64 Bytes for 64-bit and 52 Bytes for 32-bit format. |- | 0x2A || 0x36 || colspan="2" | 2 || e_phentsize |Contains the size of a program header table entry. |- | 0x2C || 0x38|| colspan="2" | 2 || e_phnum |Contains the number of entries in the program header table. |- | 0x2E || 0x3A || colspan="2" | 2 || e_shentsize |Contains the size of a section header table entry. |- | 0x30 || 0x3C || colspan="2" | 2 || e_shnum |Contains the number of entries in the section header table. |- | 0x32 || 0x3E || colspan="2" | 2 || e_shstrndx |Contains index of the section header table entry that contains the section names. |- |0x34 |0x40 | colspan="3" | |End of ELF Header (size) |} Program header The program header table tells the system how to create a process image. It is found at file offset e_phoff, and consists of e_phnum entries, each with size e_phentsize. The layout is slightly different in 32-bit ELF vs 64-bit ELF, because the p_flags are in a different structure location for alignment reasons. Each entry is structured as: PT_LOOS to PT_HIOS (PT_LOPROC to PT_HIPROC) is an inclusive reserved ranges for operating system (processor) specific semantics. |- | || 0x04 || || 4 ||p_flags||Segment-dependent flags (position for 64-bit structure). |- | 0x04 || 0x08 || 4 || 8||p_offset||Offset of the segment in the file image. |- | 0x08 || 0x10 || 4 || 8 ||p_vaddr||Virtual address of the segment in memory. |- | 0x0C || 0x18 || 4 || 8 ||p_paddr||On systems where physical address is relevant, reserved for segment's physical address. |- | 0x10 || 0x20 || 4 || 8 ||p_filesz||Size in bytes of the segment in the file image. May be 0. |- | 0x14 || 0x28 || 4 || 8 ||p_memsz||Size in bytes of the segment in memory. May be 0. |- | 0x18 || || 4 || ||p_flags||Segment-dependent flags (position for 32-bit structure). |- | 0x1C || 0x30 || 4 || 8 ||p_align||0 and 1 specify no alignment. Otherwise should be a positive, integral power of 2, with p_vaddr equating p_offset modulus p_align. |- |0x20 |0x38 | colspan="3" | |End of Program Header (size) |} Section header |- | colspan="2" |0x08 |4 |8 |sh_flags |Identifies the attributes of the section. |- |0x0C |0x10 |4 |8 |sh_addr |Virtual address of the section in memory, for sections that are loaded. |- |0x10 |0x18 |4 |8 |sh_offset |Offset of the section in the file image. |- |0x14 |0x20 |4 |8 |sh_size |Size in bytes of the section in the file image. May be 0. |- |0x18 |0x28 | colspan="2" |4 |sh_link |Contains the section index of an associated section. This field is used for several purposes, depending on the type of section. |- |0x1C |0x2C | colspan="2" |4 |sh_info |Contains extra information about the section. This field is used for several purposes, depending on the type of section. |- |0x20 |0x30 |4 |8 |sh_addralign |Contains the required alignment of the section. This field must be a power of two. |- |0x24 |0x38 |4 |8 |sh_entsize |Contains the size, in bytes, of each entry, for sections that contain fixed-size entries. Otherwise, this field contains zero. |- |0x28 |0x40 | colspan="3" | |End of Section Header (size) |} Tools * readelf is a Unix binary utility that displays information about one or more ELF files. A free software implementation is provided by GNU Binutils. * elfutils provides alternative tools to GNU Binutils purely for Linux. * elfdump is a command for viewing ELF information in an ELF file, available under Solaris and FreeBSD. * objdump provides a wide range of information about ELF files and other object formats. objdump uses the Binary File Descriptor library as a back-end to structure the ELF data. * The Unix file utility can display some information about ELF files, including the instruction set architecture for which the code in a relocatable, executable, or shared object file is intended, or on which an ELF core dump was produced. Applications Unix-like systems The ELF format has replaced older executable formats in various environments. It has replaced a.out and COFF formats in Unix-like operating systems: * Linux * Solaris / Illumos * IRIX * FreeBSD * NetBSD * OpenBSD * Redox * DragonFly BSD * Syllable * HP-UX (except for 32-bit PA-RISC programs which continue to use SOM) * QNX Neutrino * MINIX Non-Unix adoption ELF has also seen some adoption in non-Unix operating systems, such as: * OpenVMS, in its Itanium and x86-64 versionshttps://vmssoftware.com/pdfs/State_of_Port_20160906.pdf * BeOS Revision 4 and later for x86 based computers (where it replaced the Portable Executable format; the PowerPC version stayed with Preferred Executable Format) * Haiku, an open source reimplementation of BeOS * RISC OS * Stratus VOS, in PA-RISC and x86 versions * Windows 10 Anniversary Update using the Windows Subsystem for Linux. ZDNet|last=Foley|first=Mary Jo|website=ZDNet|access-date=2016-08-19}} * SkyOS * Fuchsia OS * Z/TPF * HPE NonStop OS p. 44 archived from the original on 2018-5-30 Game consoles Some game consoles also use ELF: * PlayStation Portable,PlayStation Portable use encrypted & relocated ELF : PSP PlayStation Vita, PlayStation 2, PlayStation 3, PlayStation 4 * GP2X * Dreamcast * Wii PowerPC Other (operating) systems running on PowerPC that use ELF: * AmigaOS 4, the ELF executable has replaced the prior Extended Hunk Format (EHF) which was used on Amigas equipped with PPC processor expansion cards. * MorphOS * AROS Mobile phones Some operating systems for mobile phones and mobile devices use ELF: * Symbian OS v9 uses E32Image''Symbian OS executable file format'' format that is based on the ELF file format; * Sony Ericsson, for example, the W800i, W610, W300, etc. * Siemens, the SGOLD and SGOLD2 platforms: from Siemens C65 to S75 and BenQ-Siemens E71/EL71; * Motorola, for example, the E398, SLVR L7, v360, v3i (and all phone LTE2 which has the patch applied). * Bada, for example, the Samsung Wave S8500. * Nokia phones or tablets running the Maemo or the Meego OS, for example, the Nokia N900. * Android uses ELF .so (shared object ) libraries for the Java Native Interface. With Android Runtime (ART), the default since Android 5.0 "Lollipop", all applications are compiled into native ELF binaries on installation. Some phones can run ELF files through the use of a patch that adds assembly code to the main firmware, which is a feature known as ELFPack in the underground modding culture. The ELF file format is also used with the Atmel AVR (8-bit), AVR32 and with Texas Instruments MSP430 microcontroller architectures. Some implementations of Open Firmware can also load ELF files, most notably Apple's implementation used in almost all PowerPC machines the company produced. Specifications * Generic: ** System V Application Binary Interface Edition 4.1 (1997-03-18) ** System V ABI Update (October 2009) * AMD64: ** System V ABI, AMD64 Supplement * ARM: ** ELF for the ARM Architecture * IA-32: ** System V ABI, Intel386 Architecture Processor Supplement * IA-64: ** Itanium Software Conventions and Runtime Guide (September 2000) * M32R: ** M32R ELF ABI Supplement Version 1.2 (2004-08-26) * MIPS: ** System V ABI, MIPS RISC Processor Supplement ** MIPS EABI documentation (2003-06-11) * Motorola 6800: ** Motorola 8- and 16- bit Embedded ABI * PA-RISC: ** ELF Supplement for PA-RISC Version 1.43 (October 6, 1997) * PowerPC: ** System V ABI, PPC Supplement ** ''PowerPC Embedded Application Binary Interface 32-Bit Implementation (1995-10-01) ** 64-bit PowerPC ELF Application Binary Interface Supplement Version 1.9 (2004) * SPARC: ** System V ABI, SPARC Supplement * S/390: ** S/390 32bit ELF ABI Supplement * zSeries: ** zSeries 64bit ELF ABI Supplement * Symbian OS 9: ** E32Image file format on Symbian OS 9 The Linux Standard Base (LSB) supplements some of the above specifications for architectures in which it is specified. For example, that is the case for the System V ABI, AMD64 Supplement. 86open 86open was a project to form consensus on a common binary file format for Unix and Unix-like operating systems on the common PC compatible x86 architecture, to encourage software developers to port to the architecture. The initial idea was to standardize on a small subset of Spec 1170, a predecessor of the Single UNIX Specification, and the GNU C Library (glibc) to enable unmodified binaries to run on the x86 Unix-like operating systems. The project was originally designated "Spec 150". The format eventually chosen was ELF, specifically the Linux implementation of ELF, after it had turned out to be a ''de facto'' standard supported by all involved vendors and operating systems. The group began email discussions in 1997 and first met together at the Santa Cruz Operation offices on August 22, 1997. The steering committee was Marc Ewing, Dion Johnson, Evan Leibovitch, Bruce Perens, Andrew Roach, Bryan Wayne Sparks and Linus Torvalds. Other people on the project were Keith Bostic, Chuck Cranor, Michael Davidson, Chris G. Demetriou, Ulrich Drepper, Don Dugger, Steve Ginzburg, Jon "maddog" Hall, Ron Holt, Jordan Hubbard, Dave Jensen, Kean Johnston, Andrew Josey, Robert Lipe, Bela Lubkin, Tim Marsland, Greg Page, Ronald Joe Record, Tim Ruckle, Joel Silverstein, Chia-pi Tien, and Erik Troan. Operating systems and companies represented were BeOS, BSDI, FreeBSD, Intel, Linux, NetBSD, SCO and SunSoft. The project progressed and in mid-1998, SCO began developing lxrun, an open-source compatibility layer able to run Linux binaries on OpenServer, UnixWare, and Solaris. SCO announced official support of lxrun at LinuxWorld in March 1999. Sun Microsystems began officially supporting lxrun for Solaris in early 1999, and later moved to integrated support of the Linux binary format via Solaris Containers for Linux Applications. With the BSDs having long supported Linux binaries (through a compatibility layer) and the main x86 Unix vendors having added support for the format, the project decided that Linux ELF was the format chosen by the industry and "declared itself dissolved" on July 25, 1999. FatELF: universal binaries for Linux FatELF is an ELF binary-format extension that adds fat binary capabilities. It is aimed for Linux and other Unix-like operating systems. Additionally to the CPU architecture abstraction (byte order, word size, CPU instruction set etc.), there is the potential advantage of software-platform abstraction e.g., binaries which support multiple kernel ABI versions. As of 2014, support for FatELF is not integrated in the Linux kernel mainline. See also * Application binary interface * Comparison of executable file formats * DWARF a format for debugging data * Intel Binary Compatibility Standard * Portable Executable format used by Windows * vDSO virtual DSO * Position-independent code References Further reading * |oclc=42413382 |url=https://www.iecc.com/linker/ |access-date=2020-01-12 |url-status=live |archive-url=http://archive.today/dqZj |archive-date=2012-12-05}} Code: http://archive.today/0C9xTftp://ftp.iecc.com/pub/linker/ Errata: https://linker.iecc.com/ * * An unsung hero: The hardworking ELF by Peter Seebach, December 20, 2005, archived from the original on February 24, 2007 * * The ELF Object File Format by Dissection by Eric Youngdale (1995-05-01) * A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux by Brian Raiter * ELF relocation into non-relocatable objects by Julien Vanegue (2003-08-13) * Embedded ELF debugging without ptrace by the ELFsh team (2005-08-01) * Study of ELF loading and relocs by Pat Beirne (1999-08-03) External links * FreeBSD Handbook: Binary formats (archived version) * FreeBSD elf(5) manual page * NetBSD ELF FAQ * Linux elf(5) manual page * Oracle Solaris Linker and Libraries Guide * The ERESI project : reverse engineering on ELF-based operating systems * Linux Today article on 86open July 26, 1999 * Announcement of 86open on Debian Announce mailing list October 10, 1997, Bruce Perens * Declaration of Ulrich Drepper (PDF) in The SCO Group vs IBM, September 19, 2006 * 86open and ELF discussion on Groklaw, August 13, 2006 Category:Executable file formats